CVE-2026-63030 and CVE-2026-60137: 'wp2shell' Captured Exploit Payload

Introduction

July was defined by the emergence of wp2shell, a critical WordPress attack chain that combines CVE-2026-63030 and CVE-2026-60137 to enable unauthenticated remote code execution against vulnerable WordPress installations. Within days of disclosure, public proof-of-concept code became available, both vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, and active exploitation was observed in the wild.

This report examines the vulnerabilities that comprise the wp2shell chain, reviews exploitation activity observed by F5 Labs sensors, and places the campaign in the broader context of the threat activity seen throughout July. Alongside wp2shell, attackers continued to target several long-standing vulnerabilities affecting PHP, Microsoft Exchange, MobileIron, and WordPress ecosystems.

As part of ongoing improvements to our honeynet and supporting infrastructure, we conducted substantial maintenance work throughout the month. This work is essential to ensure we remain at the forefront of threat research and analysis. As a result, portions of our telemetry were temporarily unavailable, making month-over-month event volumes and trend data less meaningful than usual. For that reason, this month's report places greater emphasis on notable exploitation activity and attacker behaviour than on raw event volume statistics.

wp2shell

CVE-2026-63030 is a route-confusion vulnerability in the WordPress REST API batch endpoint. When chained with CVE-2026-60137, it can enable unauthenticated remote code execution in the context of the vulnerable WordPress application

CVSS Score: NVD Pending (WPScan: 9.8 Critical / CISA ADP: 7.5 High)
CWE: CWE-436 (Interpretation conflict)
Affected Versions: WordPress 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2
Authentication Required: None
Published: July 17, 2026

Public proof-of-concept code is available, and active exploitation has been observed in the wild, increasing the risk to unpatched installations.

CVE-2026-60137 is a SQL injection vulnerability in WordPress Core caused by insufficient sanitization of the author__not_in argument in WP_Query. The flaw can expose sensitive database contents and, when chained with CVE-2026-63030, facilitate unauthenticated remote code execution.

CVSS Score: NVD Pending (WPScan: 5.9 Medium / CISA ADP: 9.1 Critical)
CWE: CWE-89 (SQL Injection)
Affected Versions: WordPress 6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, and 7.0.x prior to 7.0.2
Authentication Required: None when exploited as part of the wp2shell attack chain.
Published: July 17, 2026

Successful exploitation can expose information from the WordPress database and, when combined with CVE-2026-63030, enable unauthenticated remote code execution in the context of the WordPress application. Public exploit code is available, and active exploitation has been reported since disclosure.

How the Vulnerabilities Work

The wp2shell chain attracted significant security industry attention following disclosure. The availability of public proof-of-concept code, inclusion of both vulnerabilities in CISA’s Known Exploited Vulnerabilities Catalog, and confirmed in-the-wild activity make it an emergency patching priority.

CVE-2026-63030 (route confusion). The WordPress REST API exposes a batch controller at /wp-json/batch/v1 that lets clients submit multiple API requests inside a single JSON envelope. The vulnerability lies in how the batch controller resolves and dispatches nested routes. By wrapping an inner batch structure inside an outer batch request, an attacker can confuse the route dispatcher and reach handlers that would otherwise be inaccessible without authentication. On its own, the flaw does not enable code execution. Instead, it allows an unauthenticated attacker to reach the query handler affected by CVE-2026-60137.

CVE-2026-60137 (SQL injection). The WordPress REST API posts endpoint maps the public-facing author_exclude parameter to the internal author__not_in argument in WP_Query. Because that argument is improperly sanitized, crafted input supplied through author_exclude can alter the intended query and inject SQL. Detection rules should therefore look for author_exclude, which is the name that appears in HTTP traffic.

Chained together, CVE-2026-63030 allows an unauthenticated attacker to reach the vulnerable posts query, while CVE-2026-60137 allows the attacker to inject SQL through the public-facing author_exclude parameter. Public advisories report that the combined vulnerabilities can lead to remote code execution.

Observed Exploit Behavior

Captured Payload

F5 Labs observed 185.242.3.238 send a POST request to /wp-json/batch/v1. The JSON body contains nested requests that trigger the route confusion and deliver a SQL injection through the posts endpoint:

POST /wp-json/batch/v1 HTTP/1.0
Content-Type: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

{"requests": [
  {"method": "POST", "path": "///"},
  {"method": "POST", "path": "/wp/v2/posts", "body": {"requests": [
    {"method": "POST", "path": "///"},
    {"method": "GET", "path": "/wp/v2/posts/999999?author_exclude=0%29+UNION+SELECT+999999%2C2%2C0x...%2CCONCAT%280x7c7c%2CHEX%28CAST%28%28SELECT+0x4f4b%29AS+CHAR%29%29%2C0x7c7c%29...--+-&orderby=none&per_page=500"},
    {"method": "GET", "path": "/wp/v2/posts"}
  ]}},
  {"method": "POST", "path": "/batch/v1", "body": {"requests": []}}
]}

Decoding the URL-encoded value reveals a UNION-based SQL injection:

• author_exclude=0) closes the original query context.
• UNION SELECT 999999,2,... injects a crafted result row with column count matched to the WP_Query output schema.
• The marker CONCAT(0x7c7c,HEX(CAST((SELECT 0x4f4b)AS CHAR)),0x7c7c) wraps the string OK (hex 4f4b) between || delimiters (hex 7c7c). This marker is intended to reveal whether the injection succeeded by making a recognizable value appear in the JSON response.
• Hex-encoded values such as 0x7075626c697368 (publish) and 0x706f7374 (post) populate the status and type fields so the injected row renders as a legitimate post object.
• orderby=none&per_page=500 maximizes the response window.

The identical 735-byte payload was observed from 185.242.3.238 against at least two US-based sensor instances, indicating automated replay across targets. Requests to the vulnerable batch endpoint appeared in three forms: the canonical /wp-json/batch/v1 path and the permalink-independent alternatives /index.php?rest_route=/batch/v1 and /?rest_route=/batch/v1, which can be used when pretty permalinks are disabled.

Threat Assessment

F5 Labs sensors captured a fully formed wp2shell exploitation attempt: a UNION-based SQL injection delivered through the nested batch route-confusion mechanism. The same payload was replayed across multiple sensor instances, indicating automated exploitation attempts.

The following addresses generated the most requests to batch endpoint paths during the reporting period. Except for 185.242.3.238, these request counts do not establish that the traffic contained wp2shell exploit payloads:

• 47.129.160.40: 153 requests (AWS-hosted infrastructure in Singapore)
• 94.159.96.62: 64 requests
• 185.242.3.238: 51 requests (source of the captured exploit attempt)
• 207.180.249.59: 38 requests (Contabo-hosted infrastructure)
• 13.140.128.125: 24 requests

Batch endpoint requests originated from infrastructure hosted in Singapore (182), the United States (148), Germany (129), France (116), the Netherlands (74), Poland (22), Iran (20), and Hong Kong (17). Of the requests using the rest_route fallback form, 173 originated from Singapore-hosted infrastructure. These locations represent hosting infrastructure and do not indicate operator nationality.

MITRE ATT&CK Mapping

Table 1: MITRE ATT&CK mapping

Top CVEs for July 2026

Table 2: Top 10 CVEs for July 2026

Trending CVEs for July

The composition of the top 10 shifted this month, with four CVEs leaving the ranking and four new entries taking their place. CVE-2021-34523 (HPE Intelligent Management Center Remote Code Execution) and CVE-2024-44000 (LiteSpeed Cache for WordPress account takeover) dropped out of the top 10 entirely, while CVE-2016-4800 and CVE-2007-6672 moved to #11 and #12 respectively. New entrants included CVE-2018-14028, a WordPress plugin vulnerability that allows attackers to bypass ZIP file verification controls and upload malicious archives, CVE-2022-41040, the Microsoft Exchange Server vulnerability associated with the ProxyNotShell exploit chain, CVE-2021-34473, a Microsoft Exchange path confusion vulnerability also linked to ProxyShell attacks, and CVE-2020-15505. Among ranked vulnerabilities, CVE-2024-4577, the PHP CGI argument injection vulnerability that enables remote code execution on Windows-based deployments, recorded the largest positional change, moving to #10 compared with the previous reporting period.

CVE-2017-9841

Returning to the #1 position this month, this vulnerability affects the PHPUnit testing framework and allows unauthenticated remote code execution through the exposed eval-stdin.php endpoint. Although disclosed in 2017, it continues to generate substantial activity due to the widespread presence of vulnerable or abandoned PHP deployments and remains one of the clearest indicators of indiscriminate internet-wide scanning.

CVE-2024-4577

CVE-2024-4577 recorded the largest positional movement in the top 10 this month, dropping to #10 after previously ranking among the most observed vulnerabilities. The flaw affects PHP CGI on Windows and enables remote code execution through argument injection, particularly in Chinese and Japanese locale configurations. Owing to its critical severity (CVSS 9.8) and the popularity of PHP-based web applications, the vulnerability has remained a frequent target for both opportunistic scanning and exploitation activity since its disclosure.

CVE-2018-14028

This vulnerability entered the rankings at #5 this month with 844 observed attacks. The flaw affects a WordPress plugin and allows attackers to bypass ZIP file verification controls, potentially enabling the upload of malicious archives and subsequent remote code execution. While activity associated with this CVE has historically been intermittent, its reappearance highlights the continued interest in vulnerable WordPress deployments and the enduring appeal of web application exploits that provide a straightforward path to code execution.

CVE-2021-34473

Appearing in the top 10 for the first time at #7 with 770 observed attacks, CVE-2021-34473 is one of the vulnerabilities that comprise the ProxyShell exploit chain targeting Microsoft Exchange Server. The flaw allows attackers to bypass access controls and, when combined with related Exchange vulnerabilities, can lead to remote code execution and complete server compromise. Its appearance alongside other Exchange-related CVEs highlights the continued focus on internet-facing on-premises mail infrastructure by both opportunistic and targeted attackers.

CVE-2020-15505

Entering the rankings at #9 with 442 observed attacks, CVE-2020-15505 affects MobileIron Core and Connector, widely deployed mobile device management (MDM) platforms used within enterprise environments. The vulnerability allows unauthenticated remote code execution, providing attackers with a potential entry point into corporate networks through internet facing management infrastructure. Its appearance in the top 10 highlights the continued interest in enterprise management systems, which remain attractive targets due to their privileged access to devices, users, and internal resources.

Top Target Destinations

Figure 1: Destination target geographical distribution (normalized per sensor)

Canada

Attacks concentrated on command injection targeting edge devices and internet-facing appliances. Unlike neighbouring regions, this location saw a notable share of reconnaissance scanning preceding exploitation attempts.

Singapore

This location drew a high proportion of router and IoT-focused command injection alongside credential stuffing against exposed panels. Its unique profile was the heavy targeting of network infrastructure devices as an entry point for botnet recruitment.

United States

Activity was dominated by remote code execution attempts against exposed services, alongside web application exploitation targeting publicly accessible applications and management interfaces.

Japan

Sensors recorded steady remote code execution attempts against server-side frameworks and file upload handlers. The notable feature was the methodical, low-and-slow pacing of attacks designed to evade rate-based detection.

United Kingdom

Attacks focused on web application exploitation and injection attempts against public-facing portals. The notable feature was the persistent probing for exposed administrative and configuration interfaces.

Conclusion

The wp2shell vulnerability chain demonstrates how two individually distinct weaknesses can be combined to create a highly effective path to unauthenticated remote code execution on one of the world's most widely deployed content management systems. By chaining the route-confusion vulnerability tracked as CVE-2026-63030 with the SQL injection flaw CVE-2026-60137, an unauthenticated attacker can execute code in the context of the vulnerable WordPress application.

F5 Labs sensors captured fully formed wp2shell exploitation attempts targeting the vulnerable batch endpoint. The requests delivered a UNION-based SQL injection through the nested batch route-confusion mechanism. The reuse of an identical payload across multiple sensors indicates automated replay.

Several factors combine to make wp2shell particularly significant: exploitation requires no authentication, public proof-of-concept code is widely available, both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, and exploitation has been confirmed in the wild. Together, these characteristics make the vulnerability chain a significant web application threat and an urgent patching priority.

Organizations running WordPress should ensure they are operating patched versions (6.8.6, 6.9.5, 7.0.2, or later) and review logs for requests targeting /wp-json/batch/v1, ?rest_route=/batch/v1, and related WordPress REST API endpoints. As with previous large-scale exploitation campaigns, the release of patches has not ended attacker interest. Organizations should expect continued scanning and exploitation attempts against unpatched WordPress installations for the foreseeable future.

Recommendations

1. Patch affected WordPress installations immediately. Upgrade to WordPress 6.8.6, 6.9.5, 7.0.2, or a later supported release. The availability of public proof-of-concept code, inclusion in CISA’s Known Exploited Vulnerabilities Catalog, and confirmed exploitation in the wild make this an emergency patching priority.
2. Deploy WAF detections based on the exploitation technique.
   1. Monitor POST requests to /wp-json/batch/v1, /?rest_route=/batch/v1, and /index.php?rest_route=/batch/v1 containing nested requests arrays.
   2. Alert on the author_exclude REST API parameter when it contains SQL metacharacters, UNION, SELECT, hexadecimal values, or URL-encoded equivalents such as %29+UNION.
   3. Do not rely on author__not_in for network detection because that internal WP_Query argument does not appear in the HTTP request.
3. Monitor observed source addresses as time-limited indicators. The captured exploit attempt originated from 185.242.3.238. Other addresses generated substantial batch endpoint traffic, but that alone does not establish that they delivered wp2shell payloads. Validate current ownership and local context before blocking addresses or larger network ranges.
4. Restrict unauthenticated access to the WordPress REST API where operationally feasible, particularly the batch controller and author-filtered posts queries.
5. Hunt for possible post-exploitation activity. Review WordPress hosts for unexpected PHP files, recently modified application files, anomalous administrator accounts, and unexpected outbound connections from the web tier. These are precautionary checks; F5 Labs sensors did not observe a web shell being deployed in the captured activity.